Neural network black box aggressive defense method based on knowledge distillation

Abstract

The invention discloses a neural network black box aggressive defense method based on knowledge distillation, and the method comprises the steps: selecting a plurality of sub-networks to construct a teacher network, softening the input vectors of softmax layers of all sub-networks, and then reloading the model parameters of the sub-networks for training to obtain a new sub-network; obtaining a prediction label of each sub-network, and taking all prediction labels as soft labels after averaging or weighted averaging; inputting the Image Net data set into a student network, and guiding student network training by adopting a soft label, a data set hard label and a black box model special label to obtain a substitution model; adopting a white box attack algorithm to attack the substitution model to generate an adversarial sample sequence, adopting the adversarial sample sequence to attack the black box model, and selecting an adversarial sample successfully attacked in the adversarial sample sequence; and adding the successfully attacked countermeasure sample into a training set of the black box model, and performing countermeasure training by adopting the updated training set to generate the black box model with attack defense.

Description

technical field [0001] The invention relates to a defense method of a neural network, in particular to a black-box attack defense method of a neural network based on knowledge distillation. Background technique [0002] The existing common black-box attacks are divided into migration-based training substitution model attack methods and decision-based multiple query estimation gradient attack methods. After generating a substitute model close to the black-box model and estimating the gradient close to the black-box model, the two use the mainstream white-box attack method to attack. [0003] Most of the former needs to know the training data set of the attacked model, as well as a lot of information other than the internal parameters of the model, such as input and output, when training the replacement model, and this information, especially the training data set, is difficult to know in practical applications, or The number of acquisitions is limited, so the method of gener...

AI Technical Summary

Problems solved by technology

[0005] In view of the above-mentioned deficiencies in the prior art, the neural network black-box attack defense method based on knowledge distillation provided by the present invention solves the problem of high computational complexity caused by multiple queries in the traditional method

Images